95+ Percent of Systems can be Hacked

Here's an article I thought would be intresting for everyone... :)

Over 95 Percent of Systems can be Hacked

--------------------------------------------------------------------------------
Date posted in ITsecurity.com: 24 July, 2002
TesCom Highlights Lack of IT Security

Testing specialist, TesCom has today highlighted the almost total failure of companies to secure IT systems properly. TesCom, which offers a wide range of security testing services to customers throughout the world, has found that over 95 percent of all the systems it tests can be hacked one way or another.

“These findings are very concerning,” said Roy Harari, international marketing manager, TesCom information security division. “Especially considering the fact that any company coming to us and asking us to test their systems is demonstrating a significant level of awareness of security risks. If more than 95 percent of these companies can be hacked, there is no telling the risks faced by organisations that don’t have the commitment to security that our customers have.”

TesCom’s security testing division was launched in the UK early in 2001 and is expanding rapidly, to keep pace with its other security divisions around the world (over 150 security experts in total), matching the growing industry awareness of security risks. According to the DTI Information Security Breaches Survey 2002, 21 percent of UK businesses with web sites have commissioned security testing using outsourced suppliers, rising to 46 percent of companies with large transactional web sites.

TesCom’s security testing services include both ‘black box’ and ‘white box’ testing services; security code review; security guidance during development; applicative security testing; security functionality reviews; periodical intrusion testing; and more. ‘Black box’ and ‘white box’ testing services replicate hacking attempts both externally and internally to an organisation. This is especially relevant considering that a 2001 survey indicated that 76 percent of organisations consider disgruntled employees a likely source of attack. (Computer Security Issues & Trends 2001, CSI FBI)

About TesCom Ltd
TesCom mitigates business risk and reduces time to market by delivering independent, tailored software testing and quality improvement services. TesCom is the largest specialist global provider of testing services with a flexible service offering, based on best practice techniques and an in-depth market understanding of its clients’ business sectors. TesCom’s goal is to promote and deliver effective testing to make IT-based business services and applications more user-focused, responsive and robust to meet ever-increasing performance demands. To find out more about TesCom, visit www.tescom-intl.com.

THE RADICAL, any system can be cracked no matter what measures are taken if the attacker is determined enough. The article was right when it pointed out most security breeches happen from the inside rather than the outside, and outside attacks are generally script kiddies to begin with looking for easy pickings.

So, IMHO, I would say 100% of systems are hackable, but you can keep 95% of attacks out if you take the necessary precautions such as firewalls, keeping good logs, closing services that are not needed, keeping up with patches, etc.

Quote:

---

I would say 100% of systems are hackable, but you can keep 95% of attacks out if you take the necessary precautions such as firewalls, keeping good logs, closing services that are not needed, keeping up with patches, etc.

---

I agree wholeheartedly, alittlebitnumb. In my experience, nearly any system can be hacked, it's just a matter of time and energy on the part of the hacker. There are always steps one can take to protect one's computer, but you'll never be invulnerable. There'll always be a way in...

AJ

Cool, thanks for the info guys. I did think the article was cool though cause it's current and I was a little surprised at the numbers of systems that didn't have proper security. It made me realize how much some companies take chances with issues like this. Thanks though!

I wouldn't call that an article. I would call it an advertisement for testcom international. Any security professional can tell you exactly what they said. All they did was hire a couple of marketing people and tell them to make it look important. That way, they could release it as a "press release" when its actually just an advertisement. It was designed to make other companies look at their site, see how testcom can help them, and hopefully make a few thousand more sales.

Outsourcing penetration testing is great for companies that don't have an inhouse security person, but I have one major problem with it. First of all, what kind of guarantee do you get with the results? Second, its all temporary. Example: 2 months ago, a lot of companies running apache were verified as secure. Then, when the apache "chunk" vulnerabilty was released (without notification to apache) and then the expoit was released, every single one of those companies had a major vulnerabilty. Of course apache had a fix extreamly fast, but if you don't have someone in house that is watching for new vulnerabilities, then you may have missed it completely. I know of companies that have been deemed "secure" that haven't made a single change in months, so they are now vulnerable, and they don't even realize it.

Dah! Another company that states a known factor go on all the kiddes give them the raw material to market their wares. Gawd you know what a flame is hot touch it it will burn you. LOL sorry all just tired of this sort of cr.... p ah err stuff. In short takes now real thought now ah ha moment to know you can break anything...test the theory hit your monitor with a hammer know what well deal with the spraying glass and mercury vapors (hack hack). Law of a vacume I'll tell you more for $19.95 US funds :)

During a review of the hospital facilities, the Director and Doctor walking down the ward notice a man jerking off. The Director asks the Doctor, you wanna explain that.... The Doctor then explains that the patient has a rare disease where sperm fills in his testicals and that he needs to ejaculate once an hour to releave the pressure or he can die. Well, the Director says, that sounds logical. As the Director and Doctor continue down the ward, they happen by a nurse giving a patient head.... The Director turns to the Doctor, "How you gonna explain that", the Doctor calmly turns to the Director and says."Same disease, better health care plan".